“We’ve got 47 critical vulnerabilities.”Right. And? Which ones could hurt the business? What could we lose? What should we fix first? Well, we all know the basics. Confidentiality, integrity, availability, authentication and non-repudiation. Patch the weaknesses. Improve controls. Increase maturity. Job done, right? No. It still doesn’t tell the board…